Open Stack

Hi Everyone, we had sent an email to this mailing list last week on an 
issue that we are having which we thought was being generated by 
keystone but on closer inspection it seems that this is coming actually 
from Horizon policy files.

We would like to implement OpenStack using the scope based approach (v3) 
so that we could keep the main roles (reader,member and Admin) and use 
the scopes to differentiate the targets.

We have implemented the below settings in /etc/keystone/keystone.conf:

enforce_scope = true
enforce_new_defaults = true

All works well with the cli and the scopes except Horizon. We constantly 
receive errors in /var/log/keystone.log like:

2021-03-15 23:15:55.772 1611435 WARNING 
keystone.server.flask.application 
[req-a89277a2-8fb2-4fcb-b337-e76a73bb3af9 
1405ecf1ff7f4e4188648dbd1fb84c07 c584121f9d1a4334a3853c61bb5b9d93 - 
default default] You are not authorized to perform the requested action: 
identity:validate_token.: keystone.exception.ForbiddenAction: You are 
not authorized to perform the requested action: identity:validate_token

but the same command (for example an "openstack domain list") works well 
from the CLI.

We could identify the issue coming from the policy files shipped with 
the dashboard at /etc/openstack-dashboard/<policies.json> as the rules 
within these policies are not scope based and in json format while 
according to the roadmap it seems that yaml is being used for the policy 
files and they should be scope based.

When we try to convert the files to json to then upgrade them (to use 
the scope syntax) we receive the following errors:

#oslopolicy-convert-json-to-yaml --config-file 
/etc/keystone/keystone.conf --namespace keystone --output-file 
keystone_policy.yaml --policy-file keystone_policy.json
Traceback (most recent call last):
   File "/bin/oslopolicy-convert-json-to-yaml", line 10, in <module>
     sys.exit(convert_policy_json_to_yaml())
   File "/usr/lib/python3.6/site-packages/oslo_policy/generator.py", 
line 599, in convert_policy_json_to_yaml
     conf.output_file)
   File "/usr/lib/python3.6/site-packages/oslo_policy/generator.py", 
line 451, in _convert_policy_json_to_yaml
     scope_types=default_rule.scope_types)
   File "/usr/lib/python3.6/site-packages/oslo_policy/policy.py", line 
1239, in __init__
     scope_types=scope_types
   File "/usr/lib/python3.6/site-packages/oslo_policy/policy.py", line 
1154, in __init__
     self.description = description
   File "/usr/lib/python3.6/site-packages/oslo_policy/policy.py", line 
1251, in description
     raise InvalidRuleDefault('Description is required')
oslo_policy.policy.InvalidRuleDefault: Invalid policy rule default: 
Description is required.

We believe that converting such files to yaml and then upgrading them 
for scope based access (v3) should solve our issues based on the fact 
that if we disable the enforce _scope and enforce_new_defaults we can 
have a fully functional setup (but not scope based) which defies the 
initial objective

Thanks in advance for anyone that may be able to assist with this issue